Wireshark-users: [Wireshark-users] Length reported in UDP header
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Rayne <hjazz6@xxxxxxxxx>
Date: Wed, 29 Jul 2009 21:34:51 -0700 (PDT)
Hi all,

Is it common for UDP packets to have the length in its header reported
wrongly? I'm writing a program that simply parses through the various
headers in a packet, and I'm getting a lot of values larger than 1500
in my variable "size_udp", which is obtained via

size_udp = ntohs(udp->len);

where udp points to the beginning of the UDP header and len is the
length field in the UDP header.

I'm not sure if I'm parsing incorrectly, or if it's inherent in UDP
packets, as I do get correct size_udp values for other UDP packets as
well.

Thank you.